@agentlayer.tech/wallet 0.1.64 → 0.1.65

package/.openclaw/extensions/agent-wallet/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "agent-wallet",
   "name": "Agent Wallet",
   "description": "Official OpenClaw plugin bridge for the agent-wallet backends, including Solana, local BTC, and local EVM.",
-  "version": "0.1.64",
+  "version": "0.1.65",
   "contracts": {
     "tools": [
       "agentlayer_autonomous_approve",

package/.openclaw/extensions/agent-wallet/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentlayertech/agent-wallet-plugin",
-  "version": "0.1.64",
+  "version": "0.1.65",
   "description": "OpenClaw plugin bridge for the AgentLayer wallet runtime.",
   "type": "module",
   "license": "SEE LICENSE IN ../../../LICENSE",

package/VERSION

@@ -1 +1 @@
-0.1.64
+0.1.65

package/agent-wallet/agent_wallet/__init__.py

@@ -2,7 +2,7 @@
 
 # Keep in sync with package.json, pyproject.toml, and the npm installer version.
 # scripts/check_release_version.mjs enforces this on release.
-__version__ = "0.1.64"
+__version__ = "0.1.65"
 
 __all__ = [
     "config",

package/agent-wallet/agent_wallet/config.py

@@ -80,6 +80,7 @@ def reload_settings() -> Settings:
     refreshed = Settings()
     for field_name in Settings.model_fields:
         setattr(settings, field_name, getattr(refreshed, field_name))
+    clear_secret_caches()
     return settings
 
 
@@ -385,13 +386,54 @@ def _env_bool(name: str, default: bool) -> bool:
     return raw.strip().lower() in {"1", "true", "yes", "on"}
 
 
+def envelope_kdf_migration_enabled() -> bool:
+    """Whether argon2id envelopes are lazily rewritten to hkdf-sha256 after a
+    successful decrypt. Disable with AGENT_WALLET_ENVELOPE_KDF_MIGRATION=0
+    (e.g. when a rollback to a pre-hkdf runtime must stay possible)."""
+    return _env_bool("AGENT_WALLET_ENVELOPE_KDF_MIGRATION", True)
+
+
+_boot_key_keystore_cache: dict[str, str] = {}
+
+
+def clear_secret_caches() -> None:
+    """Reset all process-local secret-resolution caches.
+
+    Covers the memoized keystore backend, the boot key read from the OS
+    keystore, unsealed secrets, and derived envelope keys. Wired into
+    ``reload_settings`` so config reloads always observe fresh state; call it
+    directly in tests that rotate keystore contents in-process.
+    """
+    _boot_key_keystore_cache.clear()
+    from agent_wallet.keystore import clear_keystore_cache
+
+    clear_keystore_cache()
+    from agent_wallet.sealed_keys import clear_unseal_cache
+
+    clear_unseal_cache()
+    from agent_wallet.encrypted_storage import clear_derived_key_cache
+
+    clear_derived_key_cache()
+
+
 def read_boot_key_from_keystore() -> str:
-    """Read the boot key from the OS keystore. Never raises; '' on any failure."""
+    """Read the boot key from the OS keystore. Never raises; '' on any failure.
+
+    Successful (non-empty) reads are memoized per keystore service for the
+    process lifetime — every uncached read costs a subprocess call.
+    """
     try:
         from agent_wallet.keystore import BOOT_KEY_ITEM, resolve_keystore
 
+        service_key = os.getenv("AGENT_WALLET_KEYSTORE_SERVICE", "").strip()
+        cached = _boot_key_keystore_cache.get(service_key)
+        if cached:
+            return cached
         value = resolve_keystore().get(BOOT_KEY_ITEM)
-        return value.strip() if isinstance(value, str) else ""
+        text = value.strip() if isinstance(value, str) else ""
+        if text:
+            _boot_key_keystore_cache[service_key] = text
+        return text
     except Exception:
         return ""
 

package/agent-wallet/agent_wallet/encrypted_storage.py

@@ -6,6 +6,7 @@ import base64
 import hashlib
 import hmac
 import json
+import os
 from pathlib import Path
 from typing import Any
 
@@ -17,6 +18,10 @@ ENCRYPTED_WALLET_KIND = "openclaw-agent-wallet-secret"
 ENCRYPTED_WALLET_VERSION = 1
 USER_SCOPED_KEY_SALT = b"openclaw-agent-wallet-user-key-v1"
 
+KDF_ARGON2ID = "argon2id"
+KDF_HKDF_SHA256 = "hkdf-sha256"
+_HKDF_INFO = b"openclaw-agent-wallet-envelope-hkdf-v1"
+
 
 def _load_secretbox():
     try:
@@ -28,11 +33,19 @@ def _load_secretbox():
     return pwhash, secret, utils
 
 
-def _derive_key(master_key: str, salt: bytes) -> bytes:
-    if not master_key.strip():
-        raise WalletBackendError(
-            "Encrypted wallet storage requires AGENT_WALLET_BOOT_KEY and a sealed master_key."
-        )
+# Derived envelope keys are expensive (argon2id ~1s each), so cache them by
+# (kdf, master_key, salt). In-memory only, never serialized; bounded so a
+# pathological caller cannot grow it without limit.
+_derived_key_cache: dict[tuple[str, str, bytes], bytes] = {}
+_DERIVED_KEY_CACHE_MAX = 64
+
+
+def clear_derived_key_cache() -> None:
+    """Drop cached derived keys (wired into config.clear_secret_caches)."""
+    _derived_key_cache.clear()
+
+
+def _kdf_argon2id(master_key: str, salt: bytes) -> bytes:
     pwhash, secret, _ = _load_secretbox()
     return pwhash.argon2id.kdf(
         secret.SecretBox.KEY_SIZE,
@@ -43,6 +56,52 @@ def _derive_key(master_key: str, salt: bytes) -> bytes:
     )
 
 
+def _kdf_hkdf_sha256(master_key: str, salt: bytes) -> bytes:
+    # RFC 5869 extract+expand, one 32-byte block. Only safe because every
+    # caller passes machine-generated high-entropy key material (boot key /
+    # sealed master key) — password-hardness is what argon2id was paying for,
+    # and user passwords never reach this module.
+    prk = hmac.new(salt, master_key.encode("utf-8"), hashlib.sha256).digest()
+    return hmac.new(prk, _HKDF_INFO + b"\x01", hashlib.sha256).digest()
+
+
+def _default_write_kdf() -> str:
+    raw = os.getenv("AGENT_WALLET_ENVELOPE_KDF", "").strip().lower()
+    return KDF_ARGON2ID if raw == KDF_ARGON2ID else KDF_HKDF_SHA256
+
+
+def envelope_kdf(raw_text: str) -> str:
+    """Return the kdf recorded in an encrypted envelope ('' when not one)."""
+    try:
+        payload = json.loads(raw_text)
+    except json.JSONDecodeError:
+        return ""
+    if not isinstance(payload, dict) or payload.get("kind") != ENCRYPTED_WALLET_KIND:
+        return ""
+    return str(payload.get("kdf") or KDF_ARGON2ID)
+
+
+def _derive_key(master_key: str, salt: bytes, *, kdf: str = KDF_ARGON2ID) -> bytes:
+    if not master_key.strip():
+        raise WalletBackendError(
+            "Encrypted wallet storage requires AGENT_WALLET_BOOT_KEY and a sealed master_key."
+        )
+    if kdf == KDF_HKDF_SHA256:
+        # Cheap enough to skip the cache entirely.
+        return _kdf_hkdf_sha256(master_key, bytes(salt))
+    if kdf != KDF_ARGON2ID:
+        raise WalletBackendError(f"Encrypted wallet file uses an unsupported kdf: {kdf}")
+    cache_key = (kdf, master_key, bytes(salt))
+    cached = _derived_key_cache.get(cache_key)
+    if cached is not None:
+        return cached
+    key = _kdf_argon2id(master_key, salt)
+    if len(_derived_key_cache) >= _DERIVED_KEY_CACHE_MAX:
+        _derived_key_cache.clear()
+    _derived_key_cache[cache_key] = key
+    return key
+
+
 def _derive_user_scoped_key(
     master_key: str,
     *,
@@ -79,19 +138,27 @@ def encrypt_secret_material(
     *,
     master_key: str | None = None,
     metadata: dict[str, Any] | None = None,
+    kdf: str | None = None,
 ) -> str:
-    """Encrypt wallet secret material into a JSON envelope."""
+    """Encrypt wallet secret material into a JSON envelope.
+
+    ``kdf`` selects the key derivation for this envelope; None resolves the
+    process default (hkdf-sha256 unless AGENT_WALLET_ENVELOPE_KDF=argon2id).
+    """
+    effective_kdf = kdf if kdf is not None else _default_write_kdf()
+    if effective_kdf not in {KDF_ARGON2ID, KDF_HKDF_SHA256}:
+        raise WalletBackendError(f"Unsupported envelope kdf: {effective_kdf}")
     _, secret, utils = _load_secretbox()
     effective_master_key = master_key if master_key is not None else resolve_wallet_master_key()
     salt = utils.random(16)
-    key = _derive_key(effective_master_key, salt)
+    key = _derive_key(effective_master_key, salt, kdf=effective_kdf)
     box = secret.SecretBox(key)
     encrypted = box.encrypt(secret_material.encode("utf-8"))
     payload: dict[str, Any] = {
         "kind": ENCRYPTED_WALLET_KIND,
         "version": ENCRYPTED_WALLET_VERSION,
         "cipher": "secretbox",
-        "kdf": "argon2id",
+        "kdf": effective_kdf,
         "salt_b64": base64.b64encode(salt).decode("ascii"),
         "nonce_b64": base64.b64encode(encrypted.nonce).decode("ascii"),
         "ciphertext_b64": base64.b64encode(encrypted.ciphertext).decode("ascii"),
@@ -124,7 +191,8 @@ def decrypt_secret_material(
         raise WalletBackendError("Encrypted wallet file is malformed.") from exc
 
     effective_master_key = master_key if master_key is not None else resolve_wallet_master_key()
-    key = _derive_key(effective_master_key, salt)
+    kdf = str(payload.get("kdf") or KDF_ARGON2ID)
+    key = _derive_key(effective_master_key, salt, kdf=kdf)
     box = secret.SecretBox(key)
     try:
         plaintext = box.decrypt(ciphertext, nonce)

package/agent-wallet/agent_wallet/keystore.py

@@ -247,7 +247,32 @@ class PlaintextFileStore:
             pass
 
 
+_keystore_cache: dict[tuple[str, str], KeyStore] = {}
+
+
+def clear_keystore_cache() -> None:
+    """Drop the memoized keystore backend (e.g. after env/service changes)."""
+    _keystore_cache.clear()
+
+
 def resolve_keystore() -> KeyStore:
+    """Memoized keystore resolution.
+
+    Resolving probes the OS keystore with subprocess calls (`security`,
+    `secret-tool`, powershell), so cache the winning backend per
+    (preference, service) for the process lifetime. Cleared by
+    ``agent_wallet.config.clear_secret_caches`` / ``reload_settings``.
+    """
+    cache_key = (_backend_preference(), _service())
+    cached = _keystore_cache.get(cache_key)
+    if cached is not None:
+        return cached
+    store = _resolve_keystore_uncached()
+    _keystore_cache[cache_key] = store
+    return store
+
+
+def _resolve_keystore_uncached() -> KeyStore:
     """Return the first available OS-native backend, else the plaintext fallback."""
     preference = _backend_preference()
     if preference in {"plain", "plaintext", "plaintext-file", "file"}:

package/agent-wallet/agent_wallet/openclaw_cli.py

@@ -33,6 +33,8 @@ def _parse_csv(value: Any) -> str:
 
 
 SECRET_CONFIG_KEYS = {"privateKey", "masterKey", "approvalSecret"}
+# Always-allowed floor kept for compatibility; the live gate is the dynamic
+# set of adapter-declared read-only tools (_read_only_tool_names).
 READ_ONLY_WORKER_TOOLS = frozenset(
     {
         "get_wallet_balance",
@@ -41,6 +43,20 @@ READ_ONLY_WORKER_TOOLS = frozenset(
 )
 
 
+def _read_only_tool_names(context: Any) -> frozenset[str]:
+    """All tools the resident read worker may serve: the adapter's read-only
+    specs for this backend, plus the legacy floor."""
+    names = set(READ_ONLY_WORKER_TOOLS)
+    try:
+        for tool in context.adapter.list_tools():
+            spec = tool.model_dump() if hasattr(tool, "model_dump") else dict(tool)
+            if spec.get("read_only") is True and str(spec.get("name") or "").strip():
+                names.add(str(spec["name"]))
+    except Exception:
+        pass
+    return frozenset(names)
+
+
 def _reject_secret_config_json(config: dict[str, Any]) -> None:
     present = sorted(key for key in SECRET_CONFIG_KEYS if str(config.get(key) or "").strip())
     if present:
@@ -180,8 +196,27 @@ async def _run_invoke(
     tool_name: str,
     arguments: dict[str, Any],
     config: dict[str, Any],
+    *,
+    approval_summary: dict[str, Any] | None = None,
+    approval_mainnet_confirmed: bool = False,
+    approval_ttl_seconds: int | None = None,
 ) -> dict[str, Any]:
     context = _build_runtime_context(user_id, config)
+    # Mint the approval token in-process when the host passed the confirmation
+    # summary along with the execute call: this replaces a second cold
+    # `issue-approval` subprocess (full interpreter boot + onboarding) with a
+    # local HMAC signature. A caller-provided token always wins.
+    if (
+        isinstance(approval_summary, dict)
+        and not str(arguments.get("approval_token") or "").strip()
+    ):
+        arguments = dict(arguments)
+        arguments["approval_token"] = context.issue_execute_approval(
+            tool_name=tool_name,
+            confirmation_summary=approval_summary,
+            mainnet_confirmed=approval_mainnet_confirmed,
+            ttl_seconds=approval_ttl_seconds,
+        )
     result = await context.adapter.invoke(tool_name, arguments)
     return result.model_dump()
 
@@ -253,11 +288,16 @@ def _error_payload_for_exception(exc: Exception) -> dict[str, Any]:
     return payload
 
 
-async def _run_read_worker_tool(context: Any, request: dict[str, Any]) -> dict[str, Any]:
+async def _run_read_worker_tool(
+    context: Any,
+    request: dict[str, Any],
+    allowed_tools: frozenset[str] | None = None,
+) -> dict[str, Any]:
     tool_name = str(request.get("tool") or "").strip()
-    if tool_name not in READ_ONLY_WORKER_TOOLS:
+    effective_allowed = allowed_tools if allowed_tools is not None else READ_ONLY_WORKER_TOOLS
+    if tool_name not in effective_allowed:
         raise WalletBackendError(
-            f"read-worker only allows read-only tools: {', '.join(sorted(READ_ONLY_WORKER_TOOLS))}."
+            f"read-worker only allows read-only tools for this backend; '{tool_name}' is not one."
         )
     arguments = request.get("arguments") or {}
     if not isinstance(arguments, dict):
@@ -268,6 +308,7 @@ async def _run_read_worker_tool(context: Any, request: dict[str, Any]) -> dict[s
 
 async def _serve_read_worker(user_id: str, config: dict[str, Any]) -> int:
     context = _build_runtime_context(user_id, config, read_only=True)
+    allowed_tools = _read_only_tool_names(context)
     while True:
         line = sys.stdin.readline()
         if not line:
@@ -282,7 +323,7 @@ async def _serve_read_worker(user_id: str, config: dict[str, Any]) -> int:
             if request.get("op") == "shutdown":
                 print(json.dumps({"id": request_id, "ok": True, "stopped": True}), flush=True)
                 break
-            payload = await _run_read_worker_tool(context, request)
+            payload = await _run_read_worker_tool(context, request, allowed_tools)
             print(
                 json.dumps(
                     {
@@ -510,6 +551,15 @@ def main() -> int:
     invoke_parser.add_argument("--tool", required=True)
     invoke_parser.add_argument("--arguments-json", default="{}")
     invoke_parser.add_argument("--config-json", default="{}")
+    invoke_parser.add_argument(
+        "--approval-summary-json",
+        help=(
+            "Confirmation summary for execute calls; when provided, the approval "
+            "token is minted in this process instead of a separate issue-approval run."
+        ),
+    )
+    invoke_parser.add_argument("--approval-mainnet-confirmed", action="store_true")
+    invoke_parser.add_argument("--approval-ttl-seconds", type=int)
 
     approval_parser = subparsers.add_parser("issue-approval")
     approval_parser.add_argument("--user-id", required=True)
@@ -726,12 +776,21 @@ def main() -> int:
 
             payload = import_boot_key(_read_stdin_secret("boot key"))
         else:
+            approval_summary = None
+            raw_summary = getattr(args, "approval_summary_json", None)
+            if raw_summary:
+                approval_summary = _load_json(raw_summary)
             payload = asyncio.run(
                 _run_invoke(
                     args.user_id,
                     args.tool,
                     _load_json(args.arguments_json),
                     config,
+                    approval_summary=approval_summary,
+                    approval_mainnet_confirmed=bool(
+                        getattr(args, "approval_mainnet_confirmed", False)
+                    ),
+                    approval_ttl_seconds=getattr(args, "approval_ttl_seconds", None),
                 )
             )
     except Exception as exc:

package/agent-wallet/agent_wallet/sealed_keys.py

@@ -11,6 +11,16 @@ from agent_wallet.wallet_layer.base import WalletBackendError
 
 SEALED_KEYS_FILENAME = "sealed_keys.json"
 
+# Single-entry cache: (boot_key, path, mtime_ns, size) -> secrets. Unsealing
+# runs a KDF, so repeated resolutions in one process must pay it only once.
+# File identity in the key makes rotation (re-seal) self-invalidating.
+_unseal_cache: dict[tuple[str, str, int, int], dict[str, str]] = {}
+
+
+def clear_unseal_cache() -> None:
+    """Drop cached unsealed secrets (wired into config.clear_secret_caches)."""
+    _unseal_cache.clear()
+
 
 def resolve_sealed_keys_path() -> Path:
     """Resolve the encrypted secret bundle path under the OpenClaw home directory."""
@@ -35,11 +45,12 @@ def seal_keys(boot_key: str, secrets: dict[str, str]) -> Path:
     encrypted = encrypt_secret_material(payload, master_key=boot_key)
     path = resolve_sealed_keys_path()
     atomic_write_text(path, encrypted, mode=0o600)
+    clear_unseal_cache()
     return path
 
 
 def unseal_keys(boot_key: str) -> dict[str, str]:
-    """Decrypt all secrets from the sealed file."""
+    """Decrypt all secrets from the sealed file. Memoized by file identity."""
     if not boot_key.strip():
         return {}
 
@@ -47,7 +58,17 @@ def unseal_keys(boot_key: str) -> dict[str, str]:
     if not path.exists():
         return {}
 
-    plaintext = decrypt_secret_material(path.read_text(encoding="utf-8"), master_key=boot_key)
+    try:
+        stat = path.stat()
+    except OSError:
+        return {}
+    cache_key = (boot_key, str(path), stat.st_mtime_ns, stat.st_size)
+    cached = _unseal_cache.get(cache_key)
+    if cached is not None:
+        return dict(cached)
+
+    raw_text = path.read_text(encoding="utf-8")
+    plaintext = decrypt_secret_material(raw_text, master_key=boot_key)
     try:
         payload = json.loads(plaintext)
     except json.JSONDecodeError as exc:
@@ -58,4 +79,39 @@ def unseal_keys(boot_key: str) -> dict[str, str]:
     for key, value in payload.items():
         if isinstance(key, str) and isinstance(value, str):
             secrets[key] = value
+    _maybe_migrate_envelope_kdf(boot_key, secrets, raw_text)
+    _unseal_cache.clear()
+    _unseal_cache[cache_key] = dict(secrets)
     return secrets
+
+
+def _maybe_migrate_envelope_kdf(boot_key: str, secrets: dict[str, str], raw_text: str) -> None:
+    """Lazily re-seal an argon2id file as hkdf-sha256 after a successful unseal.
+
+    Best-effort: any failure leaves the (still readable) argon2id file in
+    place. The boot key is machine-generated high entropy, so hkdf loses no
+    security while dropping ~1s of KDF per cold process. Rollback caveat:
+    pre-hkdf runtimes cannot read the rewritten file — kill switch is
+    AGENT_WALLET_ENVELOPE_KDF_MIGRATION=0.
+    """
+    from agent_wallet.config import envelope_kdf_migration_enabled
+    from agent_wallet.encrypted_storage import (
+        KDF_ARGON2ID,
+        KDF_HKDF_SHA256,
+        _default_write_kdf,
+        envelope_kdf,
+    )
+
+    try:
+        if not envelope_kdf_migration_enabled():
+            return
+        if _default_write_kdf() == KDF_ARGON2ID:
+            return  # forced-argon2id installs must not rewrite in place forever
+        if envelope_kdf(raw_text) != KDF_ARGON2ID:
+            return
+        payload = json.dumps(secrets, indent=2)
+        encrypted = encrypt_secret_material(payload, master_key=boot_key, kdf=KDF_HKDF_SHA256)
+        atomic_write_text(resolve_sealed_keys_path(), encrypted, mode=0o600)
+        clear_unseal_cache()
+    except Exception:
+        pass

package/agent-wallet/agent_wallet/user_wallets.py

@@ -52,13 +52,27 @@ def resolve_user_wallet_path(user_id: str, network: str | None = None) -> Path:
     return user_dir / f"solana-{effective_network}-agent.json"
 
 
-def _user_wallet_metadata(user_id: str, address: str, network: str | None = None) -> dict[str, str]:
+def _user_wallet_metadata(
+    user_id: str,
+    address: str,
+    network: str | None = None,
+    key_scope: str | None = None,
+) -> dict[str, str]:
     effective_network = normalize_solana_network(network or settings.solana_network)
-    return {
+    metadata = {
         "address": address,
         "user_id": user_id,
         "network": effective_network,
     }
+    # Record which master-key scope encrypted this envelope so the loader can
+    # try the matching candidate first instead of paying a wasted KDF on the
+    # wrong one. Writes through _resolve_user_wallet_master_key follow
+    # use_per_user_key_derivation(), so that is the accurate default.
+    effective_scope = key_scope or (
+        "per-user-derived" if use_per_user_key_derivation() else "global-master"
+    )
+    metadata["key_scope"] = effective_scope
+    return metadata
 
 
 def _resolve_effective_network(network: str | None = None) -> str:
@@ -126,12 +140,25 @@ def _load_user_wallet_secret_material(
     if not is_encrypted_wallet_payload(raw_text):
         return raw_text, "plaintext", None
 
-    last_exc: WalletBackendError | None = None
-    for key_scope, candidate in _candidate_user_wallet_master_keys(
+    candidates = _candidate_user_wallet_master_keys(
         user_id,
         network,
         raw_master_key=raw_master_key,
-    ):
+    )
+    # Try the scope recorded at encryption time first: a mismatched candidate
+    # costs a full (failed) KDF before the right one is attempted. Files
+    # without the marker keep the legacy order.
+    try:
+        import json as _json
+
+        recorded_scope = (_json.loads(raw_text).get("metadata") or {}).get("key_scope")
+    except Exception:
+        recorded_scope = None
+    if isinstance(recorded_scope, str) and recorded_scope:
+        candidates.sort(key=lambda item: item[0] != recorded_scope)
+
+    last_exc: WalletBackendError | None = None
+    for key_scope, candidate in candidates:
         try:
             return (
                 decrypt_secret_material(raw_text, master_key=candidate),
@@ -147,6 +174,58 @@ def _load_user_wallet_secret_material(
     )
 
 
+def _maybe_migrate_wallet_envelope_kdf(
+    path: Path,
+    secret_material: str,
+    *,
+    user_id: str,
+    network: str,
+    key_scope: str | None,
+    address: str,
+) -> None:
+    """Lazily rewrite an argon2id wallet envelope as hkdf-sha256.
+
+    Re-encrypts with the SAME key scope that just decrypted the file, so this
+    never performs a scope migration through the back door. Best-effort: any
+    failure leaves the (still readable) argon2id file untouched. Kill switch:
+    AGENT_WALLET_ENVELOPE_KDF_MIGRATION=0.
+    """
+    from agent_wallet.config import envelope_kdf_migration_enabled
+    from agent_wallet.encrypted_storage import (
+        KDF_ARGON2ID,
+        _default_write_kdf,
+        envelope_kdf,
+    )
+
+    try:
+        if not envelope_kdf_migration_enabled():
+            return
+        if _default_write_kdf() == KDF_ARGON2ID:
+            return  # forced-argon2id installs must not rewrite in place forever
+        if key_scope not in {"per-user-derived", "global-master"}:
+            return
+        if envelope_kdf(path.read_text(encoding="utf-8")) != KDF_ARGON2ID:
+            return
+        if key_scope == "per-user-derived":
+            master_key = _derive_user_scoped_key(
+                resolve_wallet_master_key(), user_id=user_id, network=network
+            )
+        else:
+            master_key = resolve_wallet_master_key()
+        if not master_key.strip():
+            return
+        write_encrypted_wallet_file(
+            path,
+            secret_material,
+            master_key=master_key,
+            metadata=_user_wallet_metadata(
+                user_id, address, network=network, key_scope=key_scope
+            ),
+        )
+    except Exception:
+        pass
+
+
 def ensure_user_solana_wallet(
     user_id: str,
     network: str | None = None,
@@ -206,6 +285,15 @@ def ensure_user_solana_wallet(
                 metadata=_user_wallet_metadata(user_id, signer.address, network=effective_network),
             )
             key_scope = "per-user-derived"
+        elif storage_format == "encrypted":
+            _maybe_migrate_wallet_envelope_kdf(
+                path,
+                secret_material,
+                user_id=user_id,
+                network=effective_network,
+                key_scope=key_scope,
+                address=signer.address,
+            )
         return {
             "user_id": user_id,
             "address": signer.address,

package/agent-wallet/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "agent-wallet",
   "name": "Agent Wallet",
   "description": "Plugin-friendly wallet backend for OpenClaw agents with safe wallet tools and runtime instructions across Solana, local BTC, and local EVM.",
-  "version": "0.1.64",
+  "version": "0.1.65",
   "skills": ["skills/wallet-operator"],
   "configSchema": {
     "type": "object",

package/agent-wallet/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "openclaw-agent-wallet"
-version = "0.1.64"
+version = "0.1.65"
 description = "Plugin-friendly wallet backend for OpenClaw agents"
 requires-python = ">=3.10"
 dependencies = [

package/agent-wallet/scripts/build_release_bundle.py

@@ -19,15 +19,23 @@ INCLUDED_ROOT_FILES = [
     "LICENSE",
     "README.md",
     "RELEASING.md",
+    "VERSION",
     "install-from-github.sh",
     "requirements.txt",
     "setup.sh",
 ]
+# Must cover every setup.sh require_path and mirror the npm package `files`
+# allowlist (RELEASING.md "What Ships") — the bundle is the same runtime users
+# get from npx, just delivered as a GitHub Release asset.
 INCLUDED_TOP_LEVEL_DIRS = [
-    "codex",
+    ".claude-plugin",
     ".openclaw",
-    "agent-a2a-gateway",
     "agent-wallet",
+    "bin",
+    "claude-code",
+    "codex",
+    "hermes",
+    "scripts",
     "wdk-btc-wallet",
     "wdk-evm-wallet",
 ]

package/claude-code/plugins/agent-wallet/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "agent-wallet",
   "displayName": "Agent Wallet",
-  "version": "0.1.64",
+  "version": "0.1.65",
   "description": "Claude Code bridge for the existing AgentLayer wallet runtime. Connects to Solana, Bitcoin, and EVM wallets without creating a new one.",
   "author": {
     "name": "AgentLayer"

package/codex/plugins/agent-wallet/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-wallet",
-  "version": "0.1.64",
+  "version": "0.1.65",
   "description": "Codex plugin bridge for the AgentLayer wallet runtime.",
   "author": {
     "name": "AgentLayer"

package/codex/plugins/agent-wallet/server.py

@@ -78,6 +78,9 @@ APPROVAL_CONTEXT_MISSING_MESSAGE = (
     "operation again, wait for explicit user confirmation, then retry execute. Do not ask the "
     "user for a manual approval token."
 )
+# Tools served by the long-lived resident read worker instead of a cold CLI
+# subprocess. Seeded with the legacy floor; _build_tool_definitions() extends
+# it with every adapter-declared read-only tool at server start.
 RESIDENT_READ_ONLY_TOOLS = {
     "get_wallet_balance",
     "get_wallet_portfolio",
@@ -622,20 +625,31 @@ def _call_wallet_cli(command: str, extra_args: list[str]) -> dict[str, Any]:
         raise WalletCliError(f"agent-wallet CLI returned invalid JSON: {exc}") from exc
 
 
-def _invoke_tool(tool_name: str, arguments: dict[str, Any], config: dict[str, Any]) -> dict[str, Any]:
-    return _call_wallet_cli(
-        "invoke",
-        [
-            "--user-id",
-            _user_id(),
-            "--tool",
-            tool_name,
-            "--arguments-json",
-            json.dumps(arguments),
-            "--config-json",
-            json.dumps(config),
-        ],
-    )
+def _invoke_tool(
+    tool_name: str,
+    arguments: dict[str, Any],
+    config: dict[str, Any],
+    *,
+    approval_summary: dict[str, Any] | None = None,
+    approval_mainnet_confirmed: bool = False,
+) -> dict[str, Any]:
+    extra_args = [
+        "--user-id",
+        _user_id(),
+        "--tool",
+        tool_name,
+        "--arguments-json",
+        json.dumps(arguments),
+        "--config-json",
+        json.dumps(config),
+    ]
+    if approval_summary is not None:
+        # The invoke subprocess mints the approval token itself, so an execute
+        # costs one cold start instead of two (issue-approval + invoke).
+        extra_args.extend(["--approval-summary-json", json.dumps(approval_summary)])
+        if approval_mainnet_confirmed:
+            extra_args.append("--approval-mainnet-confirmed")
+    return _call_wallet_cli("invoke", extra_args)
 
 
 class _ResidentReadWorker:
@@ -943,33 +957,16 @@ def _prewarm_resident_read_worker() -> None:
     ).start()
 
 
-def _issue_approval_token(
-    tool_name: str,
-    config: dict[str, Any],
-    preview_payload: dict[str, Any],
-) -> str:
+def _approval_summary_for_preview(tool_name: str, preview_payload: dict[str, Any]) -> dict[str, Any]:
+    """Build the digest-bound confirmation summary the invoke subprocess will
+    mint an approval token from (in-process, replacing the old standalone
+    issue-approval subprocess round trip)."""
     summary = preview_payload.get("confirmation_summary")
     if not isinstance(summary, dict):
         raise RuntimeError(f"No confirmation_summary available for {tool_name}.")
     summary_for_token = dict(summary)
     summary_for_token["_preview_digest"] = _preview_digest(preview_payload)
-    extra_args = [
-        "--user-id",
-        _user_id(),
-        "--tool",
-        tool_name,
-        "--summary-json",
-        json.dumps(summary_for_token),
-        "--config-json",
-        json.dumps(config),
-    ]
-    if preview_payload.get("is_mainnet") is True:
-        extra_args.append("--mainnet-confirmed")
-    payload = _call_wallet_cli("issue-approval", extra_args)
-    token = str(payload.get("approval_token") or "").strip()
-    if not token:
-        raise RuntimeError(f"issue-approval did not return an approval_token for {tool_name}.")
-    return token
+    return summary_for_token
 
 
 def _invoke_resident_read_tool(tool_name: str, arguments: dict[str, Any], config: dict[str, Any]) -> dict[str, Any]:
@@ -1041,10 +1038,17 @@ def _attach_approval_for_execute(
     tool_name: str,
     config: dict[str, Any],
     effective_params: dict[str, Any],
-) -> dict[str, Any] | None:
+) -> tuple[dict[str, Any] | None, dict[str, Any] | None]:
+    """Prepare approval context for an execute call.
+
+    Returns ``(used_cache, approval_args)``: ``used_cache`` is the consumed
+    bridge-managed preview (if any); ``approval_args`` carries the
+    digest-bound summary the invoke subprocess mints its own token from,
+    so no separate issue-approval subprocess is spawned.
+    """
     mode = str(effective_params.get("mode") or "")
     if mode not in {"execute", "intent_execute"}:
-        return None
+        return None, None
     if tool_name == "swap_solana_tokens" and mode == "execute":
         raise RuntimeError(
             "Legacy exact-preview execute is disabled for Solana Jupiter swaps in Codex. "
@@ -1053,19 +1057,22 @@ def _attach_approval_for_execute(
     cached = _latest_cached_preview(_user_id(), tool_name)
     if cached and isinstance(cached.get("preview"), dict):
         preview = cached["preview"]
-        effective_params["approval_token"] = _issue_approval_token(tool_name, config, preview)
+        approval_args = {
+            "summary": _approval_summary_for_preview(tool_name, preview),
+            "mainnet_confirmed": preview.get("is_mainnet") is True,
+        }
         if _requires_approved_preview_payload(tool_name, effective_params):
             effective_params["_approved_preview"] = preview
-        return cached
+        return cached, approval_args
     approval_token = str(effective_params.get("approval_token") or "").strip()
     if approval_token and _requires_approved_preview_payload(tool_name, effective_params):
         cached_preview = _cached_preview_for_token(_user_id(), tool_name, approval_token)
         if cached_preview is not None and "_approved_preview" not in effective_params:
             effective_params["_approved_preview"] = cached_preview
     if effective_params.get("approval_token"):
-        return None
+        return None, None
     if _should_let_backend_authorize_autonomous_execution(tool_name, effective_params, config):
-        return None
+        return None, None
     raise RuntimeError(APPROVAL_CONTEXT_MISSING_MESSAGE)
 
 
@@ -1242,6 +1249,13 @@ def _build_tool_definitions() -> list[dict[str, Any]]:
             merged.setdefault(spec["name"], spec)
     for spec in merged.values():
         spec["input_schema"] = _sanitize_schema(spec["input_schema"])
+        if spec.get("read_only") is True:
+            # Route every adapter-declared read-only tool through the resident
+            # read worker: reads then cost one warm request instead of a cold
+            # interpreter boot + onboarding per call. The worker enforces the
+            # same read_only contract on its side, and transport failures fall
+            # back to the cold subprocess path.
+            RESIDENT_READ_ONLY_TOOLS.add(spec["name"])
         if spec.get("read_only") is False:
             spec["description"] = (
                 f"{spec['description']} Preview first when supported. Execute reuses cached "
@@ -1388,9 +1402,15 @@ def _invoke_wallet_tool_blocking(
     call never freezes the MCP server (tools/list, read-only calls, and
     cancellation stay responsive).
     """
-    used_cache = _attach_approval_for_execute(tool_name, config, effective_params)
+    used_cache, approval_args = _attach_approval_for_execute(tool_name, config, effective_params)
     try:
-        payload = _invoke_tool(tool_name, effective_params, config)
+        payload = _invoke_tool(
+            tool_name,
+            effective_params,
+            config,
+            approval_summary=(approval_args or {}).get("summary"),
+            approval_mainnet_confirmed=bool((approval_args or {}).get("mainnet_confirmed")),
+        )
     except Exception as exc:
         raise _normalize_approval_context_error(exc) from exc
     _cache_preview_for_approval(_user_id(), tool_name, payload)

package/hermes/plugins/agent_wallet/plugin.yaml

@@ -1,5 +1,5 @@
 name: agent-wallet
-version: 0.1.64
+version: 0.1.65
 description: Thin Hermes Agent bridge to the existing AgentLayer/OpenClaw wallet backend
 provides_tools:
   - agent_wallet_tools

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentlayer.tech/wallet",
-  "version": "0.1.64",
+  "version": "0.1.65",
   "description": "NPM installer for the OpenClaw Agent Wallet local runtime.",
   "type": "module",
   "repository": {

package/wdk-btc-wallet/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wdk-btc-wallet",
-  "version": "0.1.64",
+  "version": "0.1.65",
   "private": true,
   "type": "module",
   "description": "Separate BTC-only wallet service built on Tether WDK.",

package/wdk-evm-wallet/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wdk-evm-wallet",
-  "version": "0.1.64",
+  "version": "0.1.65",
   "private": true,
   "type": "module",
   "description": "Separate EVM wallet service built on Tether WDK.",